Skip to content
OpenAdvisories

Package · npm

@hulumi/baseline

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 3.3
    CVE-2026-82863

    @hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection

    @hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail…

    hulumi baseline @hulumi/baseline npm
  • Medium 6.3
    CVE-2026-48037

    Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

    Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in ve…

    kerberosmansour hulumi @hulumi/baseline npm
  • High 7.1
    CVE-2026-48035

    Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened

    Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by a…

    kerberosmansour hulumi @hulumi/baseline npm